---
id: "CVE-2026-117183"
kind: "vulnerability"
aliases: ["CVE-2026-117183"]
title: "astro-notion-blog: path traversal in FeaturedImage lets attackers read and overwrite server files"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "astro-notion-blog", "fixed": [], "affected": "<= 0.13.0", "ecosystem": "npm"}]
ecosystems: []
tags: ["astro", "astro-notion-blog", "build-time", "ci", "node", "notion", "package", "self-hosted"]
not_affected_if: ["different-version", "no-external-featured-image", "static-hosting-only-no-build-from-untrusted-notion", "trusted-notion-editors"]
published_at: "2026-10-30T16:17:41+00:00"
first_seen_at: "2026-10-30T16:31:25+00:00"
updated_at: "2026-10-30T16:34:27+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-117183", "first_seen_at": "2026-10-30T16:31:25+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-30T16:34:27+00:00"}]
---

# astro-notion-blog: path traversal in FeaturedImage lets attackers read and overwrite server files

astro-notion-blog (otoyo template, latest 0.13.0) downloads Notion FeaturedImage files at build time and writes them using the remote filename without keeping the path inside ./public/notion/. A Notion editor can overwrite project files and, per a public PoC write-up, get code execution on the build host. No fixed release exists as of 2026-10-30.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:astro-notion-blog affected <= 0.13.0 fixed ?

## How to check

- Check package.json / your fork for astro-notion-blog 0.13.0 or earlier (it is a template, so compare your src/lib/notion/client.ts)
- Open downloadFile() in src/lib/notion/client.ts: if it appends the URL-decoded last path segment to ./public/notion/ with no basename/resolve check, you are exposed
- Review who has edit access to the Notion database

## Fix

No fixed version published as of 2026-10-30 (0.13.0 is the latest release). Interim, from the PoC write-up (not vendor): in downloadFile() use a random filename with the original extension, or take the basename, reject ./.. and null bytes, resolve the path and confirm it stays inside public/notion; restrict Notion edit access; run builds without secrets.

## Timeline

- 2026-10-30T16:31:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-117183
- 2026-10-30T16:34:27+00:00 analyst — Primary NVD page unreadable; no maintainer advisory found. Only source is a third-party PoC write-up (CVE listed RESERVED) claiming build-time RCE needing Notion edit access, 0.6.1-0.13.0. Releases page shows no fix. Nothing verified. Description 'crafted URL read/overwrite' is more precisely a build-time write; read claim unconfirmed.

## Documents

- [fix] otoyo/astro-notion-blog releases https://github.com/otoyo/astro-notion-blog/releases
- [poc] Primandito: build-time RCE via FeaturedImage path traversal in astro-notion-blog 0.13.0 https://github.com/Primandito/CVE-2026-117183

## From the sources

A path traversal vulnerability in the FeaturedImage component of astro-notion-blog 0.13.0 allows attackers to escape the intended directory, as well as read and overwrite files on the server via a crafted URL.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_